Hacker News Reader

Comment by cthalupa | Hacker News Reader

Bitcoin mining is not a service offered on AWS - they are spawning up EC2 instances, which are virtual machines you have root access to. From there you can mine bitcoins or do whatever else you want.

Amazon doesn't have access to the data on the instance, or a list of processes running inside of it, or similar.

View on HN

I know, but even without root isn't it trivial for Amazon to unambiguously tell that this is what the VM's are doing, without looking at anything else on the instances? How can you run virtual machine instances without knowing what the CPU's and GPU's are doing? (There is no mathematical 'private computing' or secret computing over untrusted hardware, i.e. hardware run by other people, that is used in practice anywhere in the world, where for fancy mathematical reasons the operator has no idea what the CPU or GPU of the instance they're running for someone is actually computing. It's not even a cryptographic primitive people know about, and certainly not something performed by hypervisors.)

The CPU or GPU pattern of bitcoin mining must be completely unambiguous and trivial for Amazon to detect on EC2 instances. Or am I wrong for some reason?

I would think that looking at patterns on the CPU level is almost impossible. The overhead would be enormous.

For instance if you look for a magic number. Instead of putting two numbers on the stack, and perform an addition you now have to have a conditional jump before the addition.

Maybe I'm wrong, but at least I think it would be virtually impossible.

You're right, but I meant for bitcoin mining specifically. it's incredibly resource intensive, so it's not something you have to check for all the time, just when something seems to be behaving this way suddenly (and spinning up lots of instances, etc). When there's an obvious huge resource spike, you can just check to see if it's bitcoin mining.

If they want to be neutral and not do introspection like this without permission, they can ask the user on sign-up if they want "Protection from mining processes" where sudden activity spikes will cause them to do introspection and shut down an instance if it seems to be bitcoin mining.

EDIT: plus, bitcoin mining is the same operation over, and over, and over, and over again. You don't have to "catch" it doing a particular operation. A brief sample taken at any time will show the VM doing the same exact thing. (tons of SHA hashes.)

I'm not an expert though so perhaps I'm missing something!

Reply on news.ycombinator.com